topic Hi Marius in Network Security

ASA5506-SEC-BUN-K9 Interface flaps under load

luca00001111111 — Tue, 12 Mar 2019 07:34:14 GMT

I need to bring this to your attention as problems are surmountable.

Here are the issues, the time line from when I reported the problems have so far taken over two week to diagnose a log report. Frankly I am appalled by what has transpired regarding my purchase of what I thought was a trusted brand Cisco.

I will describe this as best as possible to illustrate to you why I think the 5506 Firewall may perhaps not be fit for general sale mostly due to a software bug.

Purchased on the 29th Dec 2015, Cisco ASA5506-SEC-BUN-K9 - ASA 5506 WITH FIREPOWER - SERVICES AND SEC PLUS LICENSES.

On the 5th JAN 2016, applied new config. Problems started to occurred with the device rebooting every 24hours.

09th March, Cisco case reference 638342893 diagnosed possible faulty unit. Faulty unit replaced with new V2 ASA5506. Base unit sent, base unit missing security plus licenses. 12 hours later Cisco issue me with new licence keys on the 10th Mach resolved and applied.

11th March, new ASA5506 started rebooting intermittently again, new case, sent crash logs and additional Show Tech log, new case reference 638363679. ASA5506 : 9.5(1) - Loss of both internal and external interfaces.

12th-17th No update on a resolution from Cisco. Have reinstalled my OLD Cisco ASA 5510 back in to service. Very disappointed

completely at a loss.

18th March, from Cisco update, just want to let you know that I have escalated those crashes to our BU team. Case reassigned.

1st April 2016, today still no information back from Cisco as to a Fix. Cisco escalation team have request an immediate update however nothing received.

I hope you can now understand my disbelief at what I hoped would be a working product has turned in to an unforeseeable disaster.

Losing confidence here.

I suggest Either upgrading to

Marius Gunnerud — Sat, 02 Apr 2016 08:07:43 GMT

I suggest Either upgrading to 9.6.1 og downgrading to 9.4.2.

The 9.5 train was released and then just a few months later it was EOL. Based on this I have not upgraded any of my client's ASAs to this version, as there must have been a reason for it to go EOL so fast (although I don't know the exact reason for why such a short life.)

Please remember to select a correct answer and rate helpful posts

Hi Marius

luca00001111111 — Tue, 05 Apr 2016 11:31:22 GMT

Hi Marius Thanks for this advice, we are going to try 9.4.1 realised on 31st March 2016, But do you know why there are two different trains? as version 9.6.1 came available on 20th March. Starting to regret buying an ASA 5506-x for all the bug issues it has caused.

Unfortunately we are again

luca00001111111 — Sun, 17 Apr 2016 11:10:56 GMT

Unfortunately we are again experiencing the same issue as previously, so just to clarify, we have moved from 9.5(1) config to 9.5.2 as requested by Cisco.

The ASA 5506-X Firewall went back in to service on the 14/04/2016 at 17:46pm.

From our external monitors illustrate flapping of the external interface on 16th from 23:55pm for 8 hours intermittently http://stats.pingdom.com/1kd6v1en2fbh/442166/2016/04

Again the firewall is exhibiting crash like behaviors and is also creating new crash dump files periodically as both the internal and external interfaces become inaccessible.

This just leaves me one more alternative 9.6.1 which I am now going to try.

If upgrading to 9.6.x doesn't

Marius Gunnerud — Mon, 18 Apr 2016 02:22:54 GMT

If upgrading to 9.6.x doesn't work then I suggest opening a new TAC case and as them to involve the development team. I have set up quite a few ASA5506 and never encountered these issues.

What type of switch is the ASA connected to?

Please remember to select a correct answer and rate helpful posts

ASA is directly connected to

luca00001111111 — Mon, 18 Apr 2016 14:59:29 GMT

ASA is directly connected to Ethernet demarcation device

FSP 150CC 825 http://www.kaliaren.com/download/FSP150CCbrochure.pdf

Making some headway, Cisco have allocated the crash related to VPN traffic in vpn datapath. They think this has to do with the type of traffic that is coming onto the ASA at the time prevalent when the crashes occur at 11:45 time causing the ASA to crash.

However this entirely may not explain what is happening for the unit to fall over intermittently and for long and short duration. But we can say that it start when users completed their end of day banking, five sites log in via RDP to complete their accounts, our internal server is then requested by the users to pull some data via the VPN. I suspect that it is this that may be linked or is triggering the crashes. However it still does not fit in to play, as the Firewall has predominantly been up and down anywhere from 10minits to eight hours when using 9.5.2

Sorry just to add, internal

luca00001111111 — Mon, 18 Apr 2016 15:35:36 GMT

Sorry just to add, internal ASA interface plugs in to HP 2510G